security: Andere Geräte abmelden, IP-weites Login-Limit, dauerhafte Sperrmarke, Passwortregeln, CSP im Melde-Modus

Restliche Phase 4 aus dem Sicherheitsaudit 07.10.2026:

- Sicherheitsseite: „Andere Geräte abmelden“ rotiert remember_token und
  beendet alle anderen Sessions, die aktuelle bleibt (nicht während einer
  Impersonation).
- LoginIpThrottle: 20 Fehlversuche je IP in 15 Minuten über alle Konten.
  Gezählt über das Failed-Event, damit Livewire-Login und Fortifys
  POST /login denselben Zähler teilen; Erfolg setzt ihn nicht zurück.
- Sperrmarke für Sessions in users.sessions_revoked_at_ms statt nur im
  Cache — übersteht cache:clear. Die alte Cache-Marke zählt übergangsweise
  mit und kann im nächsten Release entfallen.
- Neue und geänderte Passwörter: mindestens 12 Zeichen, in Produktion
  zusätzlich uncompromised() (HIBP, k-Anonymität). Bestehende bleiben gültig.
- Content-Security-Policy-Report-Only in Produktion; Meldungen über
  /csp-report nach storage/logs/csp-*.log, je Meldung höchstens einmal pro
  Stunde, ohne Query und tokenartige Pfadsegmente.

Migration: users.sessions_revoked_at_ms (users hat FULLTEXT, 25 MB, Sekunden).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/Feature/SecurityHardeningTest.php

@@ -2,12 +2,18 @@
 
 use App\Models\Company;
 use App\Models\User;
+use App\Services\Auth\LoginIpThrottle;
 use Database\Seeders\RolesAndPermissionsSeeder;
 use Illuminate\Http\UploadedFile;
+use Illuminate\Support\Facades\Hash;
+use Illuminate\Support\Facades\Http;
+use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Process;
 use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Facades\Validator;
+use Illuminate\Validation\Rules\Password;
 use Livewire\Livewire;
 use Tests\TestCase;
 
@@ -148,3 +154,138 @@ test('the test suite never sends real ntfy pushes', function () {
         ->and(config('monitoring.alerts.ntfy.topic'))->toBeEmpty()
         ->and(config('monitoring.alerts.ntfy.token'))->toBeEmpty();
 });
+
+test('too many failed logins from one ip block further logins for every account', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create(['is_active' => true]);
+
+    foreach (range(1, LoginIpThrottle::MAX_FAILURES) as $i) {
+        Livewire::test('auth.login')
+            ->set('email', "unbekannt{$i}@example.test")
+            ->set('password', 'falsches-passwort')
+            ->call('login')
+            ->assertHasErrors(['email']);
+    }
+
+    // Richtige Zugangsdaten eines anderen Kontos helfen von dieser IP nicht.
+    Livewire::test('auth.login')
+        ->set('email', $user->email)
+        ->set('password', 'password')
+        ->call('login')
+        ->assertHasErrors(['email']);
+
+    $this->assertGuest();
+});
+
+test('the fortify login post shares the per-ip limit', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create(['is_active' => true]);
+
+    foreach (range(1, LoginIpThrottle::MAX_FAILURES) as $i) {
+        $this->postJson('/login', ['email' => "unbekannt{$i}@example.test", 'password' => 'falsch'])->assertUnprocessable();
+    }
+
+    $this->postJson('/login', ['email' => $user->email, 'password' => 'password'])
+        ->assertStatus(429)
+        ->assertHeader('Retry-After');
+
+    $this->assertGuest();
+});
+
+test('failed logins below the per-ip limit do not block other accounts', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create(['is_active' => true]);
+    $throttle = app(LoginIpThrottle::class);
+
+    foreach (range(1, LoginIpThrottle::MAX_FAILURES - 1) as $i) {
+        $throttle->recordFailure('127.0.0.1');
+    }
+
+    Livewire::test('auth.login')
+        ->set('email', $user->email)
+        ->set('password', 'password')
+        ->call('login')
+        ->assertHasNoErrors();
+
+    $this->assertAuthenticatedAs($user);
+});
+
+test('new passwords need at least twelve characters', function () {
+    /** @var TestCase $this */
+    $user = User::factory()->create(['is_active' => true]);
+
+    $this->actingAs($user);
+
+    Livewire::test('customer.security')
+        ->set('current_password', 'password')
+        ->set('password', 'kurz-12345')
+        ->set('password_confirmation', 'kurz-12345')
+        ->call('updatePassword')
+        ->assertHasErrors(['password']);
+
+    expect(Hash::check('password', $user->fresh()->password))->toBeTrue();
+});
+
+test('in production new passwords are checked against known leaks', function () {
+    $password = 'korrekt-pferd-batterie';
+    $hash = strtoupper(sha1($password));
+
+    Http::fake(['api.pwnedpasswords.com/range/'.substr($hash, 0, 5) => Http::response(substr($hash, 5).":42\r\n")]);
+
+    app()->instance('env', 'production');
+
+    try {
+        expect(Validator::make(['password' => $password], ['password' => Password::defaults()])->fails())->toBeTrue()
+            ->and(Validator::make(['password' => 'ein-anderes-passwort'], ['password' => Password::defaults()])->fails())->toBeFalse();
+    } finally {
+        app()->instance('env', 'testing');
+    }
+});
+
+test('html responses carry a report-only content security policy when enabled', function () {
+    /** @var TestCase $this */
+    $this->get('https://presseecho.test/de')->assertHeaderMissing('Content-Security-Policy-Report-Only');
+
+    config()->set('security.csp.report_only', true);
+
+    $policy = $this->get('https://presseecho.test/de')
+        ->assertHeaderMissing('Content-Security-Policy')
+        ->headers->get('Content-Security-Policy-Report-Only');
+
+    expect($policy)->toContain("default-src 'self'")
+        ->toContain("object-src 'none'")
+        ->toContain("frame-ancestors 'self'")
+        ->toContain('report-uri /csp-report');
+
+    $this->getJson('/api/v1/categories')->assertHeaderMissing('Content-Security-Policy-Report-Only');
+});
+
+test('csp reports are logged once per hour without query strings or tokens', function () {
+    /** @var TestCase $this */
+    config()->set('security.csp.report_only', true);
+
+    $logged = [];
+    Log::shouldReceive('channel')->with('csp')->andReturnSelf();
+    Log::shouldReceive('warning')->andReturnUsing(function (string $message, array $context) use (&$logged) {
+        $logged[] = $context;
+    });
+
+    $report = json_encode(['csp-report' => [
+        'document-uri' => 'https://pressekonto.test/magic-login/'.str_repeat('a1B2', 10).'?signature=geheim',
+        'effective-directive' => 'script-src-elem',
+        'blocked-uri' => 'https://evil.example/x.js?k=1',
+        'line-number' => 3,
+    ]]);
+
+    foreach (range(1, 2) as $i) {
+        $this->call('POST', '/csp-report', [], [], [], ['CONTENT_TYPE' => 'application/csp-report'], $report)->assertNoContent();
+    }
+
+    expect($logged)->toHaveCount(1)
+        ->and($logged[0]['document'])->toBe('https://pressekonto.test/magic-login/[Filtered]')
+        ->and($logged[0]['blocked'])->toBe('https://evil.example/x.js')
+        ->and($logged[0]['directive'])->toBe('script-src-elem');
+
+    $this->call('POST', '/csp-report', [], [], [], ['CONTENT_TYPE' => 'application/csp-report'], 'kein json')->assertNoContent();
+    expect($logged)->toHaveCount(1);
+});